search

cloudfoundry-incubator / kubo-release

Kubernetes BOSH release
https://www.cloudfoundry.org/container-runtime/
Apache License 2.0
161 stars 76 forks source link

Istio Not Working With Proxy Enabled #289

Closed leeloodub closed 3 years ago

leeloodub commented 5 years ago

What happened: Workloads do not run when Istio is installed in a proxy environment with error

Warning  FailedCreate  4m1s (x17 over 9m29s)  replicaset-controller  Error creating: Internal error occurred: failed calling admission webhook "sidecar-injector.istio.io": Post https://istio-sidecar-injector.istio-system.svc:443/inject?timeout=30s: Unable to connect

What you expected to happen: Being able to run workload with Istio in proxy env's.

How to reproduce it (as minimally and precisely as possible):

  1. Have a vSphere proxy env't.
  2. Install Istio: curl -L https://git.io/getLatestIstio | sh - cd istio-1.0.5 export PATH=$PWD/bin:$PATH
  3. Install CRD: kubectl apply -f install/kubernetes/helm/istio/templates/crds.yaml
  4. Install Istio: kubectl apply -f install/kubernetes/istio-demo-auth.yaml
  5. Deploy a sample workload with automatic sidecar injection: kubectl create namespace test kubectl label namespace test istio-injection=enabled kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml -n test

Deployments are not running.

When running kubectl apply -f samples/bookinfo/networking/bookinfo-gateway.yaml you get the error message.

Anything else we need to know?:

Environment: proxy

We have added .svc,.svc.cluster.local,.svc.cluster to no_proxy settings on kube-controller-manager and kube-apiserver which solved the issue. After that the sample app was up and running.

We believe that these values should be added into default no_proxy configuration, or the proxied components should be selected by the operator so as to keep some components without proxy at all.

cf-gitbot commented 5 years ago

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/163146308

The labels on this github issue will be updated when the story is started.